how Mcafee ENS (TP,ATP) works

[ascha]

Hi All,

i have difficulty to explained to our customer when they asked me about "can you explain to us about how the workflows of mcafee ENS (TP and ATP) in our company from detecting malwares to (delete,blocked, all action), all in condensed simple "big pictures" report,

Thanks
Ascha

[Pravas]

Hi @ascha ,

Threat Prevention & ATP provides layered security against threats.

Here's a general overview.

Threat Prevention usually relies on Definitions (AmCore/DAT) & uses GTI lookup to identify malware.

Whereas when Threat Prevention comes across a process with Unknown/low reputation, its forwarded to ATP for monitoring. ATP has its own set of rules to verify if the behavior of the process is malicious.

You can read more about each module in depth in the links below.

Threat Prevention - https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...

ATP - https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-product-guide-windows/page/GUID-74E29...

Thanks